BIN Lookup Explained: How to Identify a Card from Its First Digits

Every payment card begins with a short numeric prefix that tells software a great deal before a single authorization request is sent. That prefix is the BIN. A bin lookup decodes it into the card network, the issuing bank, the country, and the product tier. For developers building checkout flows, fraud filters, or analytics pipelines, reading the BIN correctly is the difference between routing a transaction to the right processor and silently dropping revenue.

This guide explains how BIN and IIN lookups work, what the digits actually reveal, and how the 2022 migration to 8-digit BINs changed the rules. It pairs with our deeper breakdown of card anatomy at /blog/credit-card-number-structure, and the worked validation logic in /tools/credit-card-validator.

What is a BIN number and what does a BIN lookup do?

A BIN (Bank Identification Number) is the leading 6-to-8 digits of a payment card that identify its issuer and network. A BIN lookup maps that prefix against a card BIN database to return the network, issuing bank, country, and card type. It reads only metadata, never the account holder or balance, because none of that is encoded in the prefix.

Under ISO/IEC 7812, the standard that defines card numbering, the prefix is officially the IIN (Issuer Identification Number) ^[iso-7812]. The term BIN predates the standard and survives in payment tooling, so an iin lookup and a bin lookup describe the same operation. The full card number is a Primary Account Number (PAN) of up to 19 digits: the IIN, an individual account identifier, and a single check digit computed with the Luhn algorithm ^[iso-7812].

Which card network does a BIN belong to?

The first digit of a BIN, the Major Industry Identifier, plus the leading range identify the network. Visa cards start with 4; Mastercard uses 51-55 and the newer 2221-2720 range; American Express uses 34 and 37; Discover, JCB, and UnionPay occupy their own assigned blocks. A lookup matches the longest prefix first, then narrows to the issuer.

The Mastercard 2221-2720 block was activated in 2017 to expand capacity, and any lookup written before then will misclassify those cards ^[mc-2series]. American Express documents 34 and 37 as its account prefixes with a fixed 15-digit PAN ^{[amex-numbering]}. Discover publishes its acquirer ranges including 6011, 622126-622925, 644-649, and 65 ^{[discover-ranges]}.

The issuer identification number (IIN) is the first six or eight digits of the primary account number, used to identify the issuer of the card.

What does a BIN reveal about a card?

A BIN reveals issuer-level attributes only: the card network, the issuing bank or institution, the country of issuance, the card type (debit, credit, prepaid, charge), and often the product tier (standard, gold, platinum, commercial). It never exposes the cardholder name, balance, expiry, or full account number, since those are not derivable from the prefix.

How do developers use BIN data in production?

• Transaction routing: send a card to the cheapest or most reliable processor for its network and country.
• Surcharge and interchange logic: apply different fees to credit vs. debit, or commercial vs. consumer cards.
• Fraud screening: flag a mismatch between the BIN's issuing country and the shipping or IP geolocation ^[visa-fraud].
• Analytics: segment authorization rates and chargebacks by issuer, country, and tier.
• Checkout UX: display the correct network logo and apply the right input mask as the user types.

Why did BINs change from 6 to 8 digits?

Payment networks migrated from 6-digit to 8-digit BINs starting in April 2022 because the 6-digit space was running out. An 8-digit IIN expands the pool of assignable issuer identifiers roughly a hundredfold, letting networks keep issuing unique blocks. ISO/IEC 7812 was updated in its 2017 revision to permit the longer 8-digit IIN ^[iso-7812].

Mastercard and Visa both published mandates directing acquirers and processors to support 8-digit BINs by the April 2022 deadline ^[mc-8digit]. The practical rule for engineers: index your card BIN database on the full 8 digits, and when a record only carries 6, treat the trailing two as a wildcard. Truncating an 8-digit BIN to 6 can merge two distinct issuers and corrupt routing or fraud logic.

How should a BIN checker handle both lengths?

1. Read the first 8 digits of the PAN as the candidate BIN.
2. Query the database for an exact 8-digit match first.
3. If no 8-digit record exists, fall back to a 6-digit prefix match.
4. Resolve ties by longest-prefix-wins so specific issuer blocks override broad ranges.
5. Cache results and refresh the dataset on the publisher's schedule, since BIN assignments change.

How do you test BIN logic without real card numbers?

Test BIN logic with reserved sandbox ranges that pass structural and Luhn checks but were never issued to real accounts. FakeName generates card numbers from these never-issued blocks so QA teams can exercise validators, routing rules, and form masks safely. The numbers are fictional by construction and are declined by every live authorization network.

Hardcoding a colleague's real card into a test fixture is a data-handling incident waiting to happen. Synthetic BINs remove that exposure entirely. They let you assert that your bin checker classifies a Visa prefix as Visa, that an 8-digit lookup beats a 6-digit fallback, and that a country-mismatch rule fires, all without touching cardholder data or triggering PCI DSS scope on a test environment ^[pci-dss].

Worked example: a generated number begins 4 0 1 2 8 8. The leading 4 marks the Major Industry Identifier for banking and the Visa network. Reading all 8 digits (4 0 1 2 8 8 8 8) gives the candidate BIN your lookup should query first. Validate the complete PAN with the Luhn check documented at /tools/credit-card-validator, and see how the remaining digits form the account identifier in /blog/credit-card-number-structure.

Key takeaways for developers

• A BIN/IIN is the leading 6-8 digits identifying network, issuer, country, and card type, per ISO/IEC 7812.
• A lookup returns metadata only — never names, balances, or full PANs.
• Read 8 digits first and fall back to 6; the migration deadline was April 2022.
• Use BIN data as a weighted fraud and routing signal, not a final verdict.
• Test with reserved sandbox BINs from FakeName, never real cards, to stay out of PCI scope.